Privacy Policy

1. Purpose and scope

SUBAUDIT LTD (“SubAudit”, “we”, “us”) provides workspace-based expense, invoice and receipt record services. We are the controller of the personal data described in this notice and are registered with the UK Information Commissioner's Office (registration ZC233463). Director: Saikiran Chintha. Registered office: Dartford, Kent, United Kingdom.

This notice describes how personal data is handled across our website, mobile applications, APIs and support channels. Your rights and our contact details are set out below.

2. Personal data we process

We never receive or store your online-banking username or password. SubAudit is not a bank and does not move money. Where an optional bank link is offered (see section 3), bank access is strictly read-only Account Information Services.

3. Optional bank link

The expense workspace works without any bank connection. You can forward and upload documents at any time. Where an optional bank-link feature is offered, it is provided for users who want help populating a workspace from their transaction history. It is opt-in and can be removed at any time.

When bank link is enabled, SubAudit uses Finexer for supported UK bank connections and, where offered, Setu (Account Aggregator) for Indian bank connections under the Account Aggregator framework. You authenticate with your bank through the provider's consent flow. SubAudit requests account information access only, not payment initiation.

Where bank link is used, any stored access tokens are encrypted by the application. Disconnect disables the local connection, clears the stored access token and attempts provider revocation where supported. Account deletion is a separate process; retention and backup handling should be confirmed with our support team.

4. Purposes and lawful bases

• Contract: to create and administer your account, deliver workspace records, document OCR, exports and support.
• Consent / instruction: to link a bank account and obtain read-only AIS data where you instruct Finexer or Setu (Account Aggregator); you may withdraw that instruction at any time in-product or via your bank / AA app.
• Legitimate interests: to protect the service, prevent fraud, enforce multi-factor authentication for sensitive operations, maintain security logs, measure reliability and improve product quality, balanced against your rights.
• Legal obligation: to meet UK accounting, tax, regulatory and law-enforcement requirements where applicable.

5. Recipients and data sales

We disclose personal data only to processors and professional advisers that support the service under appropriate contracts, including:

• Vercel (web and serverless API), Render (background workers), Neon PostgreSQL (primary database) and Upstash Redis (cache and queues) for application hosting and storage;
• Finexer and, where used, Setu (Account Aggregator) for optional bank connectivity;
• Stripe for subscription billing;
• Mindee, for document OCR and field extraction of invoices and receipts you upload or forward;
• an AI model provider configured by SubAudit (for example DeepSeek) when you use SubAudit AI, receiving only the content of your question and any attachment you choose to send;
• SendGrid, for sending email and receiving forwarded invoice emails;
• Vercel Blob, for stored copies of uploaded and forwarded documents (see section 6);
• Firebase (mobile sign-in), RevenueCat (mobile purchases) and OneSignal (push notifications), where you use the mobile app or enable notifications;
• Sentry, for error monitoring where it is enabled. Personal data is scrubbed from error reports before sending;
• email and professional service providers acting on our instructions.

We may also disclose data to public authorities where required by law. We do not sell personal data and do not permit it to be used for third-party advertising.

6. Security and retention

• Application-level encryption of stored bank connection tokens (where bank link is used).
• Email one-time codes at sign-in, access checks against workspace membership, and security logging.
• Retention limited to what is needed to provide the service, resolve disputes, maintain security and meet UK legal obligations; data is then deleted or irreversibly anonymised.
• Bank-link disconnect clears the local access token and attempts provider revocation where supported. Account deletion follows a separate flow.

7. International transfers and hosting

SubAudit uses Vercel (web and serverless API), Render (background workers), Neon PostgreSQL (primary database) and Upstash Redis (cache and queues) and the other service providers listed above. Some providers may process data outside the United Kingdom. Where personal data is transferred internationally, we rely on safeguards recognised under UK GDPR where required, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for details.

8. Your UK GDPR rights

Subject to the conditions and exemptions in law, you may request:

• access to your personal data;
• rectification of inaccurate data;
• erasure (“right to be forgotten”);
• restriction of processing;
• objection to processing based on legitimate interests;
• data portability for data you provided to us; and
• withdrawal of consent where consent is the basis for processing.

To exercise a right, email support@subaudit.app or use in-product account controls (including bank-link disconnect and account deletion). We may need to verify your identity before responding and will do so without undue delay and within the statutory period.

9. Complaints and contact

Please contact us first so we can investigate: support@subaudit.app. You also have the statutory right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, referencing registration ZC233463.